CVE-2026-11861
A flaw was found in FreeIPA.
Published Aug 20, 2026 · updated Oct 14, 2026 · freeipa freeipa
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
Timeline
Detection, updates, and resolution for this record.
Aug 20, 2026 · NIST NVD
Detected
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certifi
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certifi
Affected
- cpe freeipa/freeipaversion unspecified
- cpe redhat/enterprise linux10.0
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux8.0
- cpe redhat/enterprise linux9.0
Sources
- CVE.orgCVE-2026-11861
Official CVE identifier
cve.org - NIST NVDCVE-2026-11861
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name
nvd.nist.gov